Provider Credentials
AWS
Atlantis simply shells out to terraform
so you don't need to do anything special with AWS credentials.
As long as terraform
commands works where you're hosting Atlantis, then Atlantis will work.
See https://www.terraform.io/docs/providers/aws/#authentication for more detail.
Multiple AWS Accounts
Atlantis supports multiple AWS accounts through the use of Terraform's AWS Authentication.
If you're using the Shared Credentials file you'll need to ensure the server that Atlantis is executing on has the corresponding credentials file.
If you're using Assume role
you'll need to ensure that the credentials file has a default
profile that is able
to assume all required roles.
Environment variables authentication won't work for multiple accounts since Atlantis wouldn't know which environment variables to execute Terraform with.
Assume Role Session Names
If you're using Terraform < 0.12, Atlantis injects 5 Terraform variables that can be used to dynamically name the assume role session name.
Setting the session_name
allows you to trace API calls made through Atlantis back to a specific
user and repo via CloudWatch:
provider "aws" {
assume_role {
role_arn = "arn:aws:iam::ACCOUNT_ID:role/ROLE_NAME"
session_name = "${var.atlantis_user}-${var.atlantis_repo_owner}-${var.atlantis_repo_name}-${var.atlantis_pull_num}"
}
}
Atlantis runs terraform
with the following variables:
-var Argument | Description |
---|---|
atlantis_user=lkysow | The VCS username of who is running the plan command. |
atlantis_repo=runatlantis/atlantis | The full name of the repo the pull request is in. NOTE: This variable can't be used in the AWS session name because it contains a / . |
atlantis_repo_owner=runatlantis | The name of the owner of the repo the pull request is in. |
atlantis_repo_name=atlantis | The name of the repo the pull request is in. |
atlantis_pull_num=200 | The pull request number. |
If you want to use assume_role
with Atlantis and you're also using the S3 Backend,
make sure to add the role_arn
option:
terraform {
backend "s3" {
bucket = "mybucket"
key = "path/to/my/key"
region = "us-east-1"
role_arn = "arn:aws:iam::ACCOUNT_ID:role/ROLE_NAME"
# can't use var.atlantis_user as the session name because
# interpolations are not allowed in backend configuration
# session_name = "${var.atlantis_user}" WON'T WORK
}
}
Why does this not work in TF >= 0.12?
In Terraform >= 0.12, you're not allowed to set any -var
flags if those variables
aren't being used. Since we can't know if you're using these atlantis_*
variables,
we can't set the -var
flag.
You can still set these variables yourself using the extra_args
configuration.